Skip to main content

Verify automatic failover

This article refers to Platform v3.3.0. The current Platform version is v3.3.0.

Overview​

You now verify the core promise of the pair: if the active controller goes down, the standby takes over automatically, and when the node comes back the pair recovers on its own, all with no loss of control.

Start from the running system. In Deploy and Diagnostic, both controllers are up: 172.16.50.22 is Primary and 172.16.50.23 is Secondary.

Both controllers running, one Primary and one Secondary

Normal operation, Primary and Secondary up

Stop the active node​

Induce a failure on the active (Primary) controller. You can power down its node, or stop its workload from Workloads in Barbara. Here the Primary controller at 172.16.50.22 goes down.

The primary controller stopped, its connection closed in Deploy and Diagnostic

Primary controller stopped

The standby takes over​

The former Secondary immediately takes control and runs alone: its HA Role changes to Single. The application keeps running.

The remaining controller now shows the Single HA role after taking over

The standby takes over as Single

Control is not lost: the HMI stays live throughout, now served by the single active controller.

HMI still showing live process data while running on a single node

HMI live on a single node

Recovery and re-pair​

Bring the stopped node back. Start its controller again (power it up, or start its workload in Barbara).

Starting the previously stopped controller again

Starting the recovered node

The node rejoins and the pair re-pairs automatically, with no manual step. Both controllers are Operational again. The roles have swapped: 172.16.50.23 is now Primary and 172.16.50.22 is Secondary. The HMI never stopped showing live data.

HMI recovered with both controllers operational and their roles swapped

Pair recovered, roles swapped

note

After a single-node failure, whichever controller took over stays Primary when its partner returns. DEVICE_HAPRIO only forces the preferred node back to Primary after both nodes come back together from a full power cut. Failover itself works regardless of that setting.

Summary​

You deployed a redundant SoftdPAC pair from the Marketplace, connected it from EAE, ran your IEC 61499 application, and verified hands-off failover and automatic recovery. You now have a resilient software PLC on standard Barbara edge hardware, managed from one console.

To bring the controller's data into the Barbara ecosystem, an OPC UA connector can read the PLC and feed dashboards and storage. That integration, and the single-node SoftdPAC Soft PLC edition with its Pipeline and Integration delivery modes, are covered in their own guides.